Privacy notice

Version 2026-10. Plain-language summary of what this site collects, why, and the controls you hold over it — written for a claimant population scattered across eight-plus jurisdictions.

Who runs this

This site is an independent public-interest resource for purchasers of hardware wallets compromised by the October 2026 supply-chain implant. It is not affiliated with Ledger SAS, CryptoBilis, or any retailer. For data-protection purposes the maintainers act as the controller of submission records. You can act on your record directly — most rights below are self-service and require contacting no one.

The sealed model — read this first

Everything you submit is encrypted in your browser to a public key whose private key lives outside this infrastructure (libsodium sealed boxes). The server receives and stores ciphertext only. Site operators cannot read your submission while it is sealed; release happens only by your own action on the manage page (or under the consent grant you accepted). Files you attach are sealed the same way. This design is deliberate: an intake site is exactly the kind of thing attackers would want to run, so this one is built so that even its operators cannot read what you send until you say so.

Our intake additionally refuses wallet secrets in-browser. Before anything is sealed, a local detector checks what you typed for recovery-phrase and private-key patterns and blocks the submission if it finds them — because we cannot and will not ever need them. The check runs on your device; flagged text is never logged, stored, or transmitted.

What we collect

Intake fields: optional contact email (pseudonymous is fine), purchase channel, purchase date, device model, serial range (never a full serial — the form instructs otherwise), proof-of-purchase upload, drain txids/addresses, per-chain loss amounts, loss range, status, preservation status, narrative, and your publication opt-in.
Attachments: only files you select — sealed in your browser before upload.
Opt-in public fields: if you check it, only channel, device model, loss range, drain chain, and status appear on the public data page. Nothing else.

What we do not collect: your recovery phrase, private keys, full serial number, PIN, or passwords — we reject these in-browser. No IP address stored on your record, no user-agent logged to your record, no cookies, no analytics, no trackers. The abuse gate is a Cloudflare Turnstile token or a local proof-of-work (ALTCHA) — the latter identifies nothing about you.

Why we collect it

To size the affected population and loss picture per channel and region.
To coordinate remedy — producing your submission to counsel you designate or a claimant committee only under the consent state you choose.
To let you verify, retrieve, or remove your own record at any time.

No advertising, profiling, or automated decision-making. There is none.

Legal basis across jurisdictions

Submitters are worldwide; the laws below all point the same way — your consent plus the legitimate interest of organizing affected purchasers — and we apply the strictest common standard to everyone regardless of residence:

Jurisdiction	Instrument	Basis applied
EU/EEA (incl. DE, FR)	GDPR	Art. 6(1)(a) consent; Art. 6(1)(f) legitimate interest in claim organization and evidence preservation
Malaysia	PDPA 2010	Consent for processing; notice of purpose at collection
Japan	APPI	Consent; purpose-of-use specified at collection
Singapore	PDPA 2012	Consent; notified purposes only
Philippines	Data Privacy Act 2012 (RA 10173)	Consent; proportionality
Indonesia	UU PDP 2022	Consent; specified purposes
United States	State privacy laws (varies)	Consent; minimization; no sale of personal information — ever

Withdrawing consent does not undo processing already lawfully done — but because your record is sealed to you, almost nothing is processed in readable form until you say so.

Please do not submit data we didn't ask for — other people's details, health information, ID scans beyond what a report needs. If an attachment incidentally contains such material, note it or revoke and resubmit.

Who can see your record

Licensed (default): ciphertext in storage; releasable to counsel you designate or a claimant committee per your consent grant.
Sealed private: ciphertext only; no one reads it.
Released: your designated counsel/committee may decrypt. Released material cannot be recalled — say so in the grant text you accepted.
Revoked: deleted everywhere we host it.

You move between these states yourself on the manage page.

Your rights and how to use them

Right	How
Access	Manage → enter your receipt → your ciphertext is returned; decrypt locally on Verify.
Rectification	Submit a corrected record — dedupe keys on field content — or ask maintainers to annotate.
Erasure / takedown	Manage → Delete my submission. Removes the sealed record, escrow key, public listing, and all uploaded files; writes a content-free tombstone. Self-service, immediate, no approval needed.
Restriction	Manage → Keep sealed private — processing pauses; the record stays unreadable.
Portability	Your receipt retrieves your full encrypted record — decryptable only by your key.
Complaint	You may complain to your national authority — e.g., your Bundesland's commissioner or the BfDI (DE), CNIL (FR), PDPC (MY), PPC (JP), PDPC (SG), NPC (PH), your state AG (US) — or act on the record directly; deletion requires nobody's approval.

Your receipt is the credential. Treat it like a password — it is shown once and cannot be recovered by us.

Where data lives and for how long

Records sit on Cloudflare's network (Pages Functions + KV + R2), processed on globally distributed infrastructure. All claimant content is ciphertext — sealed in your browser — so storage location does not expose contents. Records persist until you revoke them or the incident effort concludes, after which remaining sealed records are deleted. Tombstones (timestamp + action only) may be retained for the consent audit trail.

Security

Payloads, PII fields, and file bodies are sealed in-browser; the server never receives plaintext or a key.
In-browser wallet-secret detector blocks submission of seed/key-shaped input before sealing.
TLS in transit; ciphertext at rest; no IP/UA written to your record.
Decryption keys live outside this infrastructure; key generation and splitting are documented in DEPLOY.md.

Caveat we won't hide: copies already decrypted by counsel/committee under a release you granted are outside our hosted control — released material cannot be recalled. Until you release, nothing readable exists to leak.